The nice thing about hashes is you can just put them into Google or wherever and see if they’ve been independently validated and how many times. Repositories like Chocolatey and even just Virus Total or message boards often have a history of “someone has seen it as this hash in the past”.

Perfect? No; but “time with this hash” and “what others have seen and for how long” does increase trust, at least for me